AN IMPROVEMENT OF STRONG PROXY SIGNATURE AND ITS
APPLICATIONS
Min-Shiang Hwang
Department of Management Information Systems, National Chung Hsing University
250 Kuo Kuang Road, 402 Taichung, Taiwan, R.O.C.
Shiang-Feng Tzeng
Department of Computer Science and Information Engineering, National Central University
No. 300, Jung-da Rd., Jung-li City, 320 Taoyuan, Taiwan, R.O.C.
Shu-Fen Chiou
Department of Computer Science and Engineering, National Chung Hsing University
250 Kuo Kuang Road, 402 Taichung, Taiwan, R.O.C.
Keywords:
Cryptography, digital signature, proxy signature, multi-proxy signature.
Abstract:
In 2001, Lee et al. proposed a strong non-designated proxy signature for the use of multi-proxy signatures at
the presence of plural delegations of multiple original signers. In this paper, we shall analyze their schemes
and offer some suggestions as to how to improve the security of those schemes.
1 INTRODUCTION
Proxy signature schemes (Mambo et al., 1996a),
(Mambo et al., 1996b) are what original signers can
use to delegate their signing capability to so-called
proxy signers. In these schemes, a proxy signature
key is created by using the original signer’s signa-
ture key. Then the proxy signer creates a signa-
ture to sign on behalf of the original signer. Several
proxy signature schemes have been widely studied
(Das et al., 2007), (Gu et al., 2005), (Guo and Liu,
2006), (Hwang et al., 2000), (Kim et al., 1997), (Pe-
tersen and Horster, 1997), (Sun, 1999), (Tzeng et al.,
2002). In 2001, Lee et al. proposed a proxy signature
scheme (Lee et al., 2001b). They have considered a
number of possible attacks on their predecessors in
their scheme.
Based on the types of weaknesses, Lee et al. (Lee
et al., 2001b) have classified proxy signatures into
strong and weak ones in terms of undeniability. A
strong proxy signature can work both as an original
signer’s signature and as a proxy signer’s signature,
while a weak proxy signature can only act as an orig-
inal signer’s signature.
In addition, Lee et al. (Lee et al., 2001b) have
also classified proxy signatures into designated and
non-designated ones in terms of the designation of the
proxy signer. They have shown that a strong proxy
signature can be used without any proxy signer be-
ing designated, because the proxy signature has ex-
plicit authentic information about the proxy signer.
Based on the above classifications, Lee et al. have
proposed a Strong Non-designated Proxy Signature
(SNPS) scheme and applied it to multi-proxy signa-
ture schemes in which multiple original signers del-
egate their signing capabilities to unspecified proxy
signers.
In this article, we shall show various attacks on
the above SNPS scheme and the SNPS-implemented
multi-proxy signature scheme. Those schemes can-
not satisfy the strong unforgeability requirement. Any
third party or original signer is not designated as a
proxy signer and thus is not allowed to create a valid
proxy signature of the proxy signer. However, the
original signer, or one of the original signers, can
forge a valid proxy signature for the proxy signer
which the proxy signer cannot repudiate.
In Sections 2 and 3, we shall review the SNPS
scheme and observe how it can be applied to the con-
struction of a multi-proxy signature scheme, and we
shall also point out their weaknesses, respectively. In
Section 4, our improved schemes and the security
analysis of the improved schemes will be proposed
and presented. Finally, the concluding remarks will
95
Hwang M., Tzeng S. and Chiou S. (2008).
AN IMPROVEMENT OF STRONG PROXY SIGNATURE AND ITS APPLICATIONS.
In Proceedings of the International Conference on Security and Cryptography, pages 95-98
DOI: 10.5220/0001919800950098
Copyright
c
 SciTePress

be in the last section.
2 THE SNPS SCHEME AND ITS
APPLICATION
In this section, we shall briefly review the Lee et
al.’s SNPS scheme (LKK-SNPS for short) (Lee et al.,
2001b) and its contribution to a multi-proxy signature
scheme (Lee et al., 2001b).
2.1 Review of the SNPS Scheme
There are three phases in the LKK-SNPS scheme:
proxy key issuing, proxy signer signing, and proxy
signature verifying. Initially, the system parameters
are defined as follows.
Let p be a large prime, q be a prime factor of p−1,
g be a generator of order q ∈ Z
∗
p
, and h(·) be a one-way
hash function. The warrant m
w
records the identity of
the original signer and the valid delegation time, etc.
m
w
does not include the identity of any proxy signer.
Each user U
i
owns a private key x
i
∈ Z
∗
q
and cor-
responding public key y = g
x
i
mod p, which are cer-
tified by the certificate authority (CA). Let U
o
be the
original signer and U
p
be the proxy signer.
• Proxy Key Issuing: U
o
chooses a random num-
ber k and computes r = g
k
mod p and σ =
x
o
h(m
w
, r) +k mod q. The tuple (m
w
, r, σ) is U
o
’s
signature on m
w
. U
o
sends (m
w
, r, σ) to U
p
. Af-
ter receiving (m
w
, r, σ), U
p
verifies by checking
whether the following equation holds:
g
σ
= y
h(m
w
,r)
o
r mod p. (1)
If it holds, U
p
computes her/his proxy private key
σ
p
as
σ
p
= σ +x
p
mod q. (2)
• Proxy Signer Signing: If a message m conforms
to m
w
, U
p
can generate a proxy signature on m
as s = S(σ
p
, m) using her/his proxy private key
σ
p
, where S(·) is a general signature generation
algorithm. The tuple (m, s, m
w
, r, y
o
, y
p
) is a valid
proxy signature.
• Proxy Signature Verifying: The verifier computes
the corresponding proxy public key:
y = y
h(m
w
,r)
o
ry
p
mod p.
The verifier can verify (m, s, m
w
, r, y
o
, y
p
) by
checking if m ∈ {m
w
} and V (y, m, σ)
?
=
true,
where V (·) is a general signature verification al-
gorithm. If those expressions hold, the proxy sig-
nature (m, s, m
w
, r, y
o
, y
p
) for m is valid.
2.2 Review of the Multi-Proxy
Signature Scheme
Let G = {U
o
1
, U
o
2
, ··· , U
o
n
} be the original group of
n original signers. Now, they are trying to delegate
their signing capabilities to some unspecified proxy
signers. First, they can perform the same steps as the
proxy key issuing phase in SNPS scheme. Each U
o
i
∈
G sends (m
w
i
, r
o
i
, σ
i
) to U
p
.
After receiving (m
w
i
, r
o
i
, σ
i
), U
p
verifies it by
Equation (1). If U
p
wants to create a proxy signature
on behalf of G under warrants {m
w
1
, m
w
2
, ··· , m
w
n
},
she/he has to generate her/his proxy private key σ
p
as
σ
p
= σ
1
+ ···+ σ
n
+ x
p
mod q. (3)
If her/his message m conforms to
{m
w
1
, m
w
2
, ··· , m
w
n
}, U
p
can create a proxy
signature on m as s = S(σ
p
, m). The tuple
(m, s, m
w
1
, r
o
1
, y
o
1
, ··· , m
w
n
, r
o
n
, y
o
n
, y
p
) is a valid
proxy signature.
Then, any verifier can generate the proxy public
key y as
y = y
h(m
w
1
,r
o
1
)
o
1
r
o
1
···y
h(m
w
n
,r
o
n
)
o
n
r
o
n
y
p
mod p.
Then, the verifier can check the validity of proxy
signature by examining if V (y, m, s)
?
=
true and m ∈
{m
w
1
, m
w
2
, ··· , m
w
n
}.
3 CRYPTANALYSIS
In this section, we shall analyze the security of
the SNPS scheme and the SNPS-implemented multi-
proxy signature scheme.
3.1 Cryptanalysis of the SNPS Scheme
In this subsection, we will show that the LKK-SNPS
scheme is vulnerable to the public key substitution
and direct forgery attacks. The original signer can
generate a valid proxy signature key σ
p
with respect
to an arbitrary user. Let the arbitrary user be some
proxy signer U
p
.
In the public key substitution attack, U
o
can make
the public key substitution attack feasible. U
o
se-
lects a random number k ∈ Z
q
, and computes r =
g
k
mod p. Then, she/he selects a random number
α ∈ Z
q
and updates her/his public key y
o
by y
o
=
g
α
(y
−h(m
w
,r)
−1
p
) mod p. Thus, the valid proxy signa-
ture key is σ
p
= αh(m
w
, r) + k mod q. The following
expressions show why σ
p
is valid.
y = y
h(m
w
,r)
o
ry
p
= (g
α
(y
−h(m
w
,r)
−1
p
))
h(m
w
,r)
ry
p
,
= g
αh(m
w
,r)
r = g
σ
p
mod p.
SECRYPT 2008 - International Conference on Security and Cryptography
96

Finally, U
o
can forge a valid proxy signature (m,
s, m
w
, r, y
o
, y
p
). In fact, U
p
has never signed the
message m, but she/he cannot deny it.
In the direct forgery attack, U
o
randomly selects
a number k ∈ Z
q
and computes r = g
k
y
−1
p
mod p.
Then, she/he computes a valid proxy signature key
σ
p
= x
o
h(m
w
, r) + k mod q because
y = y
h(m
w
,r)
o
ry
p
= y
h(m
w
,r)
o
(g
k
y
−1
p
)y
p
,
= y
h(m
w
,r)
o
g
k
= g
σ
p
mod p.
Similarly, U
o
can forge a valid proxy signature,
and U
p
cannot deny to signing the message m.
3.2 Cryptanalysis of the Multi-Proxy
Signature Scheme
In this subsection, we will show that the Lee-Kim-
Kim multi-proxy signature is vulnerable to the col-
lusion attack, the public key substitution attack, and
the direct forgery attack. Cooperation of all the origi-
nal signers or one malicious original signer can forge
valid multi-proxy signatures.
Without loss of generality, suppose
{U
o
1
, U
o
2
, ··· , U
o
n
} want to forge a multi-proxy
signature on m for an arbitrarily chosen proxy
signer U
p
by collusion attack. U
o
1
first selects
k
o
1
and computes r
o
1
= g
k
o
1
y
−1
p
mod p and σ
1
=
x
o
1
h(m
w
1
, r
o
1
) + k
o
1
mod q. Thus, the valid multi-
proxy signature key is σ
p
= σ
1
+··· + σ
n
mod q. The
following expressions show why σ
p
is valid.
y = y
h(m
w
1
,r
o
1
)
o
1
r
o
1
···y
h(m
w
n
,r
o
n
)
o
n
r
o
n
y
p
,
= y
h(m
w
1
,r
o
1
)
o
1
(g
k
o
1
y
−1
p
)···y
h(m
w
n
,r
o
n
)
o
n
r
o
n
y
p
,
= y
h(m
w
1
,r
o
1
)
o
1
g
k
o
1
···y
h(m
w
n
,r
o
n
)
o
n
r
o
n
,
= g
∑
n
i=1
σ
i
mod p.
Therefore, all the original signers can work to-
gether and use σ
p
to generate a forged multi-proxy
signature on an arbitrary message m for an arbitrary
proxy signer U
p
.
In the public key substitution attack, any orig-
inal signer can forge valid multi-proxy signatures
by updating her/his own public key. Suppose
that U
o
1
wants to forge a multi-proxy signa-
ture on m for {U
o
1
, U
o
2
, ··· , U
o
n
}. This attack is
similar in Section 3.1. U
o
1
first selects random
numbers m
w
i
, k
o
i
for i = 1, 2, ··· , n, and α, and
then she/he computes r
o
i
= g
k
o
i
mod p and y
o
1
=
g
α
(y
h(m
w
2
,r
o
2
)
o
2
r
o
2
···y
h(m
w
n
,r
o
n
)
o
n
r
o
n
y
p
)
−h(m
w
1
,r
o
1
)
−1
mod
p. Then, U
o
1
makes a request to CA for updating
her/his public key by y
o
1
. Thus, the valid proxy
signature key is σ
p
= αh(m
w
1
, r
o
1
) + k
o
1
mod q, and
its corresponding proxy public key is y = g
σ
p
mod p.
This is because
y = y
h(m
w
1
,r
o
1
)
o
1
r
o
1
··· y
h(m
w
n
,r
o
n
)
o
n
r
o
n
y
p
,
= (g
α
(y
h(m
w
2
,r
o
2
)
o
2
r
o
2
··· y
h(m
w
n
,r
o
n
)
o
n
r
o
n
y
p
)
−h(m
w
1
,r
o
1
)
−1
)
h(m
w
1
,r
o
1
)
r
o
1
··· y
h(m
w
n
,r
o
n
)
o
n
r
o
n
y
p
= g
αh(m
w
1
,r
o
1
)
r
o
1
= g
σ
p
mod p.
Therefore, U
o
1
can use σ
p
to generate a forged
multi-proxy signature on an arbitrary message m for
{U
o
1
, U
o
2
, ··· , U
o
n
}.
In the directing forgery attack, we assume U
o
1
wants to forge a multi-proxy signature on m for
{U
o
1
, U
o
2
, ··· , U
o
n
}. The forgery attack is also similar
in Section 3.1. U
o
1
first selects random numbers m
w
i
and k
o
i
for i = 1, 2, ··· , n, and then she/he computes
r
o
1
= g
k
o
1
(y
h(m
w
2
,r
o
2
)
o
2
r
o
2
···y
h(m
w
n
,r
o
n
)
o
n
r
o
n
y
p
)
−1
mod p.
Then the valid proxy signature key is σ
p
=
x
o
1
h(m
w
1
, r
o
1
) + k
o
1
mod q, and its corresponding
proxy public key is y = g
σ
p
mod p. This is because
y = y
h(m
w
1
,r
o
1
)
o
1
r
o
1
···y
h(m
w
n
,r
o
n
)
o
n
r
o
n
y
p
,
= y
h(m
w
1
,r
o
1
)
o
1
r
o
1
(y
h(m
w
2
,r
o
2
)
o
2
r
o
2
···y
h(m
w
n
,r
o
n
)
o
n
r
o
n
y
p
)
−1
···y
h(m
w
n
,r
o
n
)
o
n
r
n
y
p
= y
h(m
w
1
,r
o
1
)
o
1
r
o
1
= y
σ
p
mod p.
Therefore, U
o
1
can use σ
p
to generate a forged
multi-proxy signature on an arbitrary message m for
{U
o
1
, U
o
2
, ··· , U
o
n
}.
4 OUR IMPROVEMENT
In this section, we modify the SNPS scheme and its
multi-proxy signature scheme to remedy the weak-
nesses described in Section 3.
4.1 The Improved Schemes
In the SNPS scheme, the proxy signature can be
forged by the original signer. We modify the scheme
as follows. In the proxy signer signing phase, we turn
Equation (2) into
σ
p
= σ +x
p
h(m
w
, r, y
o
) mod q.
Therefore, the proxy public key y becomes
y = y
h(m
w
,r)
o
ry
h(m
w
,r,y
o
)
p
mod p.
To remedy the weaknesses of the multi-proxy sig-
nature scheme, we shall treat it similarly. The new σ
p
in Equation (3) is
σ
p
=
n
∑
i=1
σ
i
+ x
p
h(m
w
1
, r
o
1
, y
o
1
, ··· , m
w
n
, r
o
n
, y
o
n
) mod q.
AN IMPROVEMENT OF STRONG PROXY SIGNATURE AND ITS APPLICATIONS
97

Therefore, the proxy public key y becomes
y = y
h(m
w
1
,r
o
1
)
o
1
r
o
1
···y
h(m
w
n
,r
o
n
)
o
n
r
o
n
y
h(m
w
1
,r
o
1
,y
o
1
,···,m
w
n
,r
o
n
,y
o
n
)
p
mod p.
4.2 Security Analysis
The improved schemes can withstand all the above
attacks in Section 3. In the SNPS scheme, suppose
the signer U
o
is a malicious original signer. U
o
selects
a random integer α and makes her/his public key y
0
o
satisfy the following equation
y
0
o
= g
α
(y
−h(m
w
,r,y
o
)
−1
p
) mod p.
If U
o
fixes the integer y
0
o
, she/he will have to solve
the discrete logarithm problem to find the value of α;
on the other hand, if U
o
first determines the integer
α, then she/he has to obtain the value of y
0
o
by solv-
ing the difficult problem. Therefore, the public key
substitution attack is not likely to work.
As for the directing forgery attack, the secu-
rity analysis is the same as that of the public key
substitution attack on the improved schemes. The
proxy signature cannot be forged by direct forgery at-
tack. Therefore, those attacks on the improved SNPS
scheme and its application to multi proxy signatures
are impossible since it is difficult to obtain the proxy
signature.
5 CONCLUSIONS
In this paper, we have shown that strong non-
designated proxy signature schemes and their appli-
cations to multi-proxy signature schemes are vulner-
able to some attacks. The malicious original signer
can forge valid strong non-designated proxy signa-
tures and multi-proxy signatures. Furthermore, the
proxy signer cannot repudiate the forged proxy sig-
natures. Therefore, we have also presented our im-
proved scheme to defeat those attacks.
Lee et al. have also presented several mobile ap-
plications of strong proxy signatures. In (Lee et al.,
2001a), Lee et al. have shown that mobile agents can
be constructed by using strong non-designated proxy
signatures. However, the same attacks on strong
non-designated proxy signatures can be generalized
to work on Lee-Kim-Kim “secure” mobile agents.
Again, our improved scheme can be used here to de-
feat these attacks.
ACKNOWLEDGEMENTS
This work was supported in part by Taiwan Infor-
mation Security Center (TWISC), National Science
Council under the grants NSC 96-2219-E-001-001,
and NSC 96-2219-E-009-013.
REFERENCES
Das, M. L., Saxena, A., and Phatak, D. B. (2007). Proxy sig-
nature scheme with effective revocation using bilinear
pairings. International Journal of Network Security,
4(3):312–317.
Gu, L. Z., Zhang, S., and Yang, Y. X. (2005). An im-
proved proxy multi-signature scheme. The Journal of
China Universities of Posts and Telecommunications,
12(1):10–14.
Guo, L. and Liu, Y. (2006). Security analysis and improve-
ment of hsu et al. threshold proxy signature scheme.
International Journal of Network Security, 2(1):69–
72.
Hwang, M. S., Lin, I. C., and Lu, E. J. L. (2000). A secure
nonrepudiable threshold proxy signature scheme with
known signers. International Journal of Informatica,
11(2):1–8.
Kim, S., Park, S., and Won, D. (1997). Proxy signatures,
revisited. Proc. of ICICS’97, LNCS 1334, pages 223–
232.
Lee, B., Kim, H., and Kim, K. (2001a). Secure mobile
agent using strong non-designated proxy signature. In
Lecture Notes in Computer Science 2119, ACISP 01,
pages 474–486, Sydney, Australia.
Lee, B., Kim, H., and Kim, K. (2001b). Strong proxy signa-
ture and its applications. In The 2001 Symposium on
Cryptography and Information Security, pages 603–
608, Oiso, Japan.
Mambo, M., Usuda, K., and Okamoto, E. (1996a). Proxy
signatures: Delegation of the power to sign message.
IEICE Trans. Fundamentals, E79-A(9):1338–1353.
Mambo, M., Usuda, K., and Okamoto, E. (1996b). Proxy
signatures for delegating signing operation. Proc.
Third ACM Conf. on Computer and Communications
Security, pages 48–57.
Petersen, H. and Horster, P. (1997). Self-certified keys -
concepts and applications. In Communications and
Multimedia Security’97, pages 102–116, Chapman &
Hall.
Sun, H. M. (1999). An efficient nonrepudiable threshold
proxy signature scheme with known signers. Com-
puter Communications, 22(8):717–722.
Tzeng, S.-F., Yang, C.-Y., and Hwang, M.-S. (2002). A
nonrepudiable threshold multi-proxy multi-signature
scheme with shared verification. Proceeding of 12
th
National Conference on Information Security, R.O.C.,
pages 285–292.
SECRYPT 2008 - International Conference on Security and Cryptography
98